Skip to content
Snippets Groups Projects
Commit de094b22 authored by Marius Dumitru Florea's avatar Marius Dumitru Florea
Browse files

XWIKI-21949: Restrict the execution of script macros during a realtime WYSIWYG editing session

* Fix a bug in EntityChannelScriptAuthorTracker which didn't lower / update the script level when the target entity reference had initially a low script level (e.g. when two users edit a page whose last author didn't have script right, one of them could use the rights of the other to execute scripts)
* Assume that a request can submit data associated with multiple documents (or document translations) so don't try to determine the entity that is targeted by the request; simply compute the effective author by taking the most recent author with the least script rights
* Update since versions

(cherry picked from commit fa1c0fb1)
parent e2f51def
No related branches found
No related tags found
No related merge requests found
Showing
with 55 additions and 191 deletions
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment